A WireGuard VPN gives you remote access to Home Assistant without opening port 8123 to the internet — you install the official WireGuard add-on on Home Assistant OS, forward a single UDP port on your router, and connect from your phone or laptop as if you were on your home Wi-Fi. It's free, open-source, and considerably faster and simpler to configure than older VPN protocols like OpenVPN. The main caveat: it requires a static public IP or dynamic DNS, and if your home broadband drops, remote access drops with it — there's no cloud fallback unless you also run Home Assistant Cloud alongside it.
What is WireGuard and why use it with Home Assistant?
WireGuard is a modern VPN protocol built into the Linux kernel, designed to be small, fast, and simple to audit compared with OpenVPN or IPsec. Home Assistant's founder, Franck Nijhof, built an official WireGuard add-on specifically because alternatives like OpenVPN and PiVPN felt slow or fiddly to configure, while WireGuard offered a lean, high-performance alternative that still supported advanced routing setups.
For Home Assistant users, a self-hosted VPN means every device on your home network — not just Home Assistant itself — becomes reachable from outside, and none of it needs a port forwarded directly to the app. That matters because Home Assistant's dashboard, integrations, and add-ons expose a fairly large attack surface; putting a VPN in front of all of it means an attacker needs to break WireGuard's encryption first, not just guess a login page.
Does Home Assistant need port forwarding for WireGuard to work?
Yes, but only one port, and it's UDP rather than the web ports used by Home Assistant itself. You forward a single WireGuard UDP port (commonly 51820) from your router to the Home Assistant OS device, and nothing else needs to be exposed. This is the core security benefit over exposing Home Assistant directly: instead of port-forwarding 8123 (or 80, since Home Assistant 2026.8 changed the default port for new OS installs), you forward one WireGuard port and every other service — the web UI, add-ons, other home devices — stays invisible to the internet until a device has authenticated with a WireGuard key.
If you're also running an IoT VLAN to segment smart home devices from the rest of your network, WireGuard slots in cleanly: the VPN interface can be scoped to reach only the VLANs you choose, rather than flattening your whole network to anyone with a valid client config.
How do you install the WireGuard add-on on Home Assistant?
The official add-on is only available on Home Assistant OS or Supervised installs (not Container or Core installs, which need a manually configured WireGuard instance instead). The basic steps:
- Set up dynamic DNS if your ISP doesn't give you a static IP — most UK residential connections rotate IPs periodically, so a free DDNS service (DuckDNS is a common pairing with the add-on) keeps a stable hostname pointed at your home.
- Forward UDP port 51820 (or a port of your choosing) on your router to your Home Assistant OS device's local IP.
- Install the WireGuard add-on from Settings → Add-ons → Add-on Store, searching for "WireGuard".
- Configure the Host field with your public IP or DDNS hostname, and set an Addresses range for the VPN subnet that doesn't overlap your existing home network — for example
10.10.10.1/24if your LAN already uses192.168.x.x. - Start the add-on and generate a client configuration for each device (phone, laptop) that needs remote access — the add-on produces a QR code and a downloadable config file per peer.
- Install a WireGuard client app on the remote device (official apps exist for iOS, Android, Windows, macOS and Linux) and import the config or scan the QR code.
Once connected, the remote device gets an IP inside your home network's range and can reach Home Assistant at its normal local address — no separate remote URL or Nabu Casa subscription needed for the connection itself.
Is WireGuard safer than exposing Home Assistant directly to the internet?
Yes — putting a VPN in front of Home Assistant is generally considered the more secure option compared with forwarding Home Assistant's own port to the internet. When you expose Home Assistant directly, every vulnerability in the web frontend, any installed add-on, or a weak password becomes a route in for anyone scanning the internet. Home Assistant's own HTTP integration documentation flags this risk directly and recommends a VPN or reverse proxy with authentication instead of a bare port-forward. With WireGuard, the only thing listening on the internet is the WireGuard interface itself, which uses public-key cryptography — a stolen password alone isn't enough to get in, an attacker also needs a valid private key that never leaves your device.
It's worth noting this isn't unique to WireGuard forwarding — the same principle applies whether you're using a dedicated VLAN'd network setup or a basic home router: minimising what's actually reachable from the internet is the single biggest lever for reducing risk.
WireGuard vs Home Assistant Cloud (Nabu Casa): which should you use?
Home Assistant Cloud, run by Nabu Casa, is the official paid alternative — it tunnels your Home Assistant instance through Nabu Casa's servers so you get a public HTTPS URL with no port forwarding or router configuration at all, plus Google/Alexa voice integration and cloud text-to-speech. It runs on a subscription (Nabu Casa publishes current rates on its own pricing page, since they vary by region and change periodically) with a free trial to test it first.
| Factor | WireGuard (self-hosted) | Home Assistant Cloud |
|---|---|---|
| Cost | Free (uses your own broadband) | Paid subscription, free trial available |
| Setup effort | Router port forward + DDNS + add-on config | Enable in Settings → Home Assistant Cloud, no router changes |
| Access scope | Whole home network, not just Home Assistant | Home Assistant web UI/app only |
| Works if home broadband is down | No | No (both depend on your home internet being up) |
| Extras | None built in | Google/Alexa integration, cloud TTS/STT |
Many experienced users run both: WireGuard for full network access when doing maintenance, and Home Assistant Cloud (or a reverse proxy) as a simpler day-to-day option for voice assistant integration. They aren't mutually exclusive — the WireGuard add-on's own documentation suggests keeping Home Assistant Cloud as a backup access method in case the VPN configuration ever breaks.
Common WireGuard connection problems
Handshake fails / can't connect at all: almost always a port forwarding issue — double check the router is forwarding UDP (not TCP) on the correct port to the Home Assistant OS device's current local IP, which can change if you haven't reserved a DHCP lease for it.
Connects but can't reach Home Assistant: check the Addresses range in the add-on doesn't overlap your existing LAN subnet, and that your router isn't blocking traffic between the VPN subnet and the rest of the network (some routers apply AP/client isolation rules that also catch VPN traffic).
Works on Wi-Fi but not mobile data: some mobile networks use carrier-grade NAT or block certain UDP ports; try changing the add-on's listening port to something less commonly filtered, like 443.
IP address changed and remote access broke: this is what dynamic DNS solves — without it, every time your ISP reassigns your public IP, your WireGuard Host field goes stale until you update it manually.
